GDPR Compliance

Our Commitment to GDPR

river-muse is committed to complying with the General Data Protection Regulation (GDPR) for all individuals in the European Economic Area (EEA). This page outlines how we handle personal data in accordance with GDPR requirements.

Data Controller

river-muse acts as the data controller for personal information collected through our website and services. Our contact details are:

river-muse
250 University Avenue, Suite 400
Toronto, ON M5H 3E5
Canada

Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you voluntarily submit information through our forms or subscribe to communications
• Contract: When processing is necessary to fulfill our service agreements with you
• Legitimate Interests: For business operations that do not override your fundamental rights, such as website analytics and service improvement
• Legal Obligation: When required to comply with applicable laws

Your Rights Under GDPR

As a data subject in the EEA, you have the following rights:

• Right of Access: You may request a copy of the personal data we hold about you
• Right to Rectification: You may request correction of inaccurate or incomplete data
• Right to Erasure: You may request deletion of your personal data in certain circumstances
• Right to Restrict Processing: You may request limitation of how we process your data
• Right to Data Portability: You may request your data in a structured, machine-readable format
• Right to Object: You may object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, we may extend this period by two additional months, in which case we will inform you of the extension and the reasons for it.

We may request verification of your identity before processing your request to ensure we protect your data from unauthorized access.

International Data Transfers

As a Canadian company, we may transfer personal data outside the EEA. When doing so, we ensure appropriate safeguards are in place, including:

• Adequacy decisions by the European Commission
• Standard contractual clauses approved by the European Commission
• Other legally approved transfer mechanisms

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. When data is no longer needed, it is securely deleted or anonymized.

Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include encryption, access controls, and regular security assessments.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in high risk to you, we will also notify you directly.

Supervisory Authority

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection supervisory authority. For individuals in the EEA, you may contact your national Data Protection Authority.

Updates to This Information

We may update this GDPR information periodically. Material changes will be communicated through our website or direct communication where appropriate.

Contact

For questions about our GDPR compliance or to exercise your rights, please contact us at [email protected]